Trigger a scan by GitHub repo (auto-onboard)
Auto-onboards the repository on first run — requires the BreachLens GitHub App installed on that account — then queues a scan. Requires the scans:trigger scope. Returns 503 if GitHub App auth is unavailable (App not installed / not authorized).
Authorizations
Scoped API token from Settings → API Tokens (scopes: scans:trigger, scans:read).
Headers
Cloudflare Access service-token client id (ends in .access). Only for CF-Access-fronted deployments; leave blank for self-hosted.
Cloudflare Access service-token secret. Pair it with CF-Access-Client-Id.
Body
owner/name of the GitHub repository.
"my-org/payments-api"
Commit SHA (CI metadata for auto-discovery).
"a1b2c3d4"
Branch name (CI metadata).
"main"
PR/MR number (CI metadata).
42
Scan tiers to run. Omit for the server default (SAST, SCA, SECRET, IAC for repositories). Valid values depend on target type.